Also reload SSL context on bip reload, allowing for SSL cert updates

- on BIP reload, check if SSL files are readable, and try to load new
  SSL context.
- on success only, update SSL context for new client connections

This allows for SSL certificate/key updates on /BIP reload or SIGHUP.

Signed-off-by: Loïc Gomez <bip@animanova.fr>

src/bip_main.c

@@ -68,7 +68,6 @@ void rlimit_cpu_reached(int i);
 void rlimit_bigfile_reached(int i);
 void conf_die(bip_t *bip, char *fmt, ...);
 int fireup(bip_t *bip, FILE *conf);
-int check_ssl_files(int failmode);
 int do_pid_stuff(void);
 
 static void usage(char *name)
@@ -144,44 +143,6 @@ static pid_t daemonize(void)
 	return getpid();
 }
 
-int check_ssl_files(int failmode)
-{
-	int e;
-	struct stat fs;
-
-	if (!conf_ssl_certfile) {
-		conf_ssl_certfile = default_path(
-			conf_biphome, "bip.pem", "SSL certificate");
-	}
-
-	if (failmode == HARD_FAIL)
-		assert_path_exists(conf_ssl_certfile);
-	else if (!check_path_exists(conf_ssl_certfile))
-		return 0;
-
-	e = stat(conf_ssl_certfile, &fs);
-	if (e)
-		mylog(LOG_WARN,
-			  "Unable to check PEM file, stat(%s): %s",
-			  conf_ssl_certfile, strerror(errno));
-	else if ((fs.st_mode & S_IROTH) | (fs.st_mode & S_IWOTH))
-		mylog(LOG_ERROR,
-			  "PEM file %s should not be world "
-			  "readable / writable. Please fix the modes.",
-			  conf_ssl_certfile);
-
-	if (conf_client_dh_file) {
-		if (failmode == HARD_FAIL) {
-			assert_path_exists(conf_client_dh_file);
-		} else if (!check_path_exists(conf_client_dh_file)) {
-			return 0;
-		}
-	}
-
-	/* all is well */
-	return 1;
-}
-
 int main(int argc, char **argv)
 {
 	FILE *conf = NULL;
@@ -303,8 +264,31 @@ int main(int argc, char **argv)
 
 #ifdef HAVE_LIBSSL
 	if (conf_css) {
-        check_ssl_files(HARD_FAIL);
-    }
+		int e;
+		struct stat fs;
+
+		if (!conf_ssl_certfile) {
+			conf_ssl_certfile = default_path(
+				conf_biphome, "bip.pem", "SSL certificate");
+		}
+		assert_path_exists(conf_ssl_certfile);
+
+		e = stat(conf_ssl_certfile, &fs);
+		if (e)
+			mylog(LOG_WARN,
+			      "Unable to check PEM file, stat(%s): "
+			      "%s",
+			      conf_ssl_certfile, strerror(errno));
+		else if ((fs.st_mode & S_IROTH) | (fs.st_mode & S_IWOTH))
+			mylog(LOG_ERROR,
+			      "PEM file %s should not be world "
+			      "readable / writable. Please fix the modes.",
+			      conf_ssl_certfile);
+
+		if (conf_client_dh_file) {
+			assert_path_exists(conf_client_dh_file);
+		}
+	}
 #endif
 
 	check_dir(conf_log_root, 1);
@@ -342,10 +326,8 @@ int main(int argc, char **argv)
 		log_file_setup();
 
 #ifdef HAVE_LIBSSL
-		/*
-         * reload SSL context if server-side SSL is enabled and SSL files
-		 * seem accessible.
-         */
+		/* reload SSL context if server-side SSL is enabled and SSL files
+		 * seem accessible */
 		if (conf_css) {
 			if (check_ssl_files(SOFT_FAIL)) {
 				if (set_ssl_context(SSLCTX_FORCE_UPDATE) == 1)

src/connection.c

@@ -34,7 +34,6 @@ extern char *conf_client_ciphers;
 extern char *conf_client_dh_file;
 static int SSLize(connection_t *cn, int *nc);
 static SSL_CTX *SSL_init_context(char *ciphers);
-SSL_CTX *get_ssl_context(void);
 /* SSH like trust management */
 int link_add_untrusted(void *ls, X509 *cert);
 #endif
@@ -1232,77 +1231,6 @@ static int ctx_set_dh(SSL_CTX *ctx)
             conf_client_dh_file);
 	return 1;
 }
-
-int set_ssl_context(int force)
-{
-	SSL_CTX *newctx = NULL;
-	if (sslctx) {
-		if (force == SSLCTX_FORCE_UPDATE) {
-			mylog(LOG_DEBUG, "SSL context already set, forcing update");
-		} else {
-			mylog(LOG_DEBUG, "SSL context is already set, not updating");
-			return 0;
-		}
-	} else {
-		mylog(LOG_DEBUG, "Initializing SSL context for accepted connections");
-	}
-
-	newctx = get_ssl_context();
-	if (!newctx) {
-		mylog(LOG_ERROR, "Failed to get new SSL context");
-		if (sslctx)
-			mylog(LOG_WARN, "Keeping old SSL context");
-		return 0;
-	}
-	sslctx = newctx;
-	return 1;
-}
-
-SSL_CTX *get_ssl_context(void)
-{
-	SSL_CTX *newctx = NULL;
-	if (!(newctx = SSL_init_context(conf_client_ciphers))) {
-		mylog(LOG_ERROR, "SSL context initialization failed");
-		return NULL;
-	}
-
-	if (!conf_client_dh_file) {
-		// try with a default path but don't fail if it doesn't exist
-		conf_client_dh_file = default_path(conf_biphome, "dh.pem",
-					 "DH parameters");
-
-		struct stat st_buf;
-		if (stat(conf_client_dh_file, &st_buf) != 0) {
-			free(conf_client_dh_file);
-			conf_client_dh_file = NULL;
-		}
-	}
-
-	if (conf_client_dh_file) {
-		if (!ctx_set_dh(newctx)) {
-			SSL_CTX_free(newctx);
-			mylog(LOG_ERROR, "SSL Unable to load DH parameters");
-			return NULL;
-		}
-	}
-
-	mylog(LOG_DEBUG, "Loading SSL cert from %s", conf_ssl_certfile);
-	if (!SSL_CTX_use_certificate_chain_file(newctx, conf_ssl_certfile)) {
-		mylog(LOG_WARN, "SSL: Unable to load certificate file");
-		SSL_CTX_free(newctx);
-		return NULL;
-	}
-
-	mylog(LOG_DEBUG, "Loading SSL key from %s", conf_ssl_certfile);
-	if (!SSL_CTX_use_PrivateKey_file(newctx, conf_ssl_certfile,
-					 SSL_FILETYPE_PEM)) {
-		mylog(LOG_WARN, "SSL: Unable to load key file");
-		SSL_CTX_free(newctx);
-		return NULL;
-	}
-
-	return newctx;
-}
 #endif
 
 connection_t *accept_new(connection_t *cn)
@@ -1338,11 +1266,52 @@ connection_t *accept_new(connection_t *cn)
 	conn->client = 1;
 #ifdef HAVE_LIBSSL
 	if (cn->ssl) {
-		if (!sslctx)
-			set_ssl_context(SSLCTX_NO_REPLACE);
 		if (!sslctx) {
-			connection_free(conn);
-			return NULL;
+			mylog(LOG_DEBUG,
+			      "No SSL context available for "
+			      "accepted connections. "
+			      "Initializing...");
+			if (!(sslctx = SSL_init_context(conf_client_ciphers))) {
+				mylog(LOG_ERROR,
+				      "SSL context initialization "
+				      "failed");
+				connection_free(conn);
+				return NULL;
+			}
+
+			if (!conf_client_dh_file) {
+				// try with a default path but don't fail if it
+				// doesn't exist
+				conf_client_dh_file =
+					default_path(conf_biphome, "dh.pem",
+						     "DH parameters");
+
+				struct stat st_buf;
+				if (stat(conf_client_dh_file, &st_buf) != 0) {
+					free(conf_client_dh_file);
+					conf_client_dh_file = NULL;
+				}
+			}
+
+			if (conf_client_dh_file) {
+				if (!ctx_set_dh(sslctx)) {
+					mylog(LOG_ERROR,
+					      "SSL Unable to load DH "
+					      "parameters");
+					connection_free(conn);
+					return NULL;
+				}
+			}
+
+			if (!SSL_CTX_use_certificate_chain_file(
+				    sslctx, conf_ssl_certfile))
+				mylog(LOG_WARN,
+				      "SSL: Unable to load "
+				      "certificate file");
+			if (!SSL_CTX_use_PrivateKey_file(sslctx,
+							 conf_ssl_certfile,
+							 SSL_FILETYPE_PEM))
+				mylog(LOG_WARN, "SSL: Unable to load key file");
 		}
 
 		conn->ssl_h = SSL_new(sslctx);

src/connection.h

@@ -60,9 +60,6 @@
 #define SSL_CHECK_NONE (0)
 #define SSL_CHECK_BASIC (1)
 #define SSL_CHECK_CA (2)
-
-#define SSLCTX_NO_REPLACE 0
-#define SSLCTX_FORCE_UPDATE 1
 #endif
 
 struct connecting_data;
@@ -116,9 +113,4 @@ uint16_t connection_localport(connection_t *cn);
 uint16_t connection_remoteport(connection_t *cn);
 char *connection_localip(connection_t *cn);
 char *connection_remoteip(connection_t *cn);
-#ifdef HAVE_LIBSSL
-/* Set SSL context, force update if already set and force is 1
- * Return 1 if SSL context has been set */
-int set_ssl_context(int force);
-#endif
 #endif

src/path_util.c

@@ -35,15 +35,3 @@ void assert_path_exists(char *path)
 	if (stat(path, &st_buf) != 0)
 		fatal("Path %s doesn't exist (%s)", path, strerror(errno));
 }
-
-int check_path_exists(char *path)
-{
-	struct stat st_buf;
-
-	if (stat(path, &st_buf) != 0) {
-		mylog(LOG_WARN, "Path %s doesn't exist (%s)", path, strerror(errno));
-        return 0;
-    } else {
-        return 1;
-    }
-}

src/path_util.h

@@ -18,7 +18,5 @@
 char *default_path(const char *biphome, const char *filename, const char *desc);
 /* exit program if path doesn't exist */
 void assert_path_exists(char *path);
-/* return 1 if path exists, 0 otherwise */
-int check_path_exists(char *path);
 
 #endif